Microsoft Entra ID and Azure RBAC

Two questions: who are you, and what may you do?

Authentication answers "who are you?": proving your identity, for example with a password and a code on your phone. Authorisation answers "what may you do?": read this storage account, restart that VM. In Azure, Microsoft Entra ID handles authentication, and Azure role-based access control (Azure RBAC) handles authorisation for Azure resources.

Microsoft Entra ID is the new name, from 2023, for Azure Active Directory (Azure AD). Many older documents, job posts and exam dumps still say Azure AD; they mean the same service. It is a cloud identity service, not the same thing as the Windows Server Active Directory that runs in office server rooms, although the two are often connected.

Kinds of identities

Managed identities come in two kinds. A system-assigned identity is created for one resource and deleted with it. A user-assigned identity is a separate resource you create once and attach to several resources; it lives until you delete it. Whenever Azure code needs to call another Azure service, prefer a managed identity over a stored secret.

Signing in safely

• MFA (multi-factor authentication): something you know plus something you have, such as the Microsoft Authenticator app. It stops most password attacks.
• Passwordless: Authenticator sign-in, passkeys or FIDO2 security keys, and Windows Hello for Business. Nothing to phish.
• Conditional Access: if-then rules, for example "if the user is an admin, require MFA" or "block sign-ins from outside India for this app". It needs an Entra ID P1 licence or higher.
• Security defaults: a free, simple baseline that turns on MFA for everyone. Use it if you have no Conditional Access policies.

Azure RBAC: role assignments

A role assignment has three parts. The security principal is who (a user, group, service principal or managed identity). The role definition is what they may do, a list of allowed actions. The scope is where: a management group, a subscription, a resource group or a single resource. Assignments are inherited downward: Reader on a subscription means Reader on every resource group and resource in it.

Azure RBAC is additive: if you have Reader from one assignment and Contributor from another, you get both. There are hundreds of narrower built-in roles too, such as Virtual Machine Contributor or Storage Blob Data Reader, and you can write custom roles in JSON.

az role assignment create --assignee asha@contoso.com --role "Reader" \
  --scope "/subscriptions/<subscription-id>/resourceGroups/rg-web"
az role assignment list --assignee asha@contoso.com --all --output table

az vm identity assign --resource-group rg-web --name vm-web-01   # system-assigned managed identity

{
  "Name": "VM Operator (custom)",
  "IsCustom": true,
  "Description": "Can see, start, stop and restart virtual machines.",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/powerOff/action",
    "Microsoft.Compute/virtualMachines/restart/action"
  ],
  "NotActions": [],
  "AssignableScopes": ["/subscriptions/<subscription-id>"]
}

Entra roles are not Azure roles

There are two separate role systems, and mixing them up is a classic interview question. Microsoft Entra roles, such as Global Administrator or User Administrator, manage the directory: creating users, resetting passwords, registering apps. Azure roles, such as Owner or Reader, manage Azure resources: VMs, networks, storage. A Global Administrator does not automatically get access to subscriptions, although they can choose to elevate their access when needed.

Least privilege and PIM

Least privilege means giving each identity only the access it needs, at the smallest scope, for only as long as needed. Assign roles to groups rather than people, prefer narrow built-in roles over Owner, and choose a resource group scope over a subscription scope where you can.

Privileged Identity Management (PIM) adds just-in-time access. Instead of being Owner all the time, an engineer is "eligible" and activates the role for, say, two hours, with a reason, MFA and sometimes an approval. Every activation is logged. PIM needs Entra ID P2 or Entra ID Governance licences.